-
开启docker remote api 并添加证书
配置证书（网上找到一个好用的脚本，直接梭哈） #!/bin/sh export PASSWORD="123123" export COUNTRY="CN" export STATE="xxx" export CITY="xxx" export ORGANIZATION="xxx" export ORGANIZATIONAL_UNIT="bugku" export COMMON_NAME="aman.docker" export EMAIL="61898864@qq.com" export HOST_NAME="$COMMON_NAME" export IP="x.x.x.x" export DIR="/etc/docker" cd $DIR # Generate CA openssl genrsa -aes256 -passout "pass:$PASSWORD" -out "$DIR/ca-key.pem" 4096 openssl req -new -x509 -days 3650 -key "$DIR/ca-key.pem" -sha256 -out "$DIR/ca.pem" -passin "pass:$PASSWORD" -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/OU=$ORGANIZATIONAL_UNIT/CN=$COMMON_NAME/emailAddress=$EMAIL" # Generate Server Certs openssl genrsa -out "$DIR/server-key.pem" 4096 openssl req -subj "/CN=$HOST_NAME" -sha256 -new -key "$DIR/server-key.pem" -out $DIR/server.csr echo "subjectAltName = DNS:$HOST_NAME,IP:$IP,IP:0.0.0.0" > $DIR/server.cnf echo "extendedKeyUsage = serverAuth" >> $DIR/server.cnf openssl x509 -req -days 3650 -sha256 -in $DIR/server.csr -passin "pass:$PASSWORD" -CA "$DIR/ca.pem" -CAkey "$DIR/ca-key.pem" -CAcreateserial -out "$DIR/server-cert.pem" -extfile $DIR/server.cnf # Generate Client Certs openssl genrsa -out "$DIR/client-key.pem" 4096 openssl req -subj '/CN=client' -new -key "$DIR/client-key.pem" -out $DIR/client.csr echo "extendedKeyUsage = clientAuth" > $DIR/client.cnf openssl x509 -req -days 3650 -sha256 -in $DIR/client.csr -passin "pass:$PASSWORD" -CA "$DIR/ca.pem" -CAkey "$DIR/ca-key.pem" -CAcreateserial -out "$DIR/client-cert.pem" -extfile $DIR/client.cnf # Modify Certs Permission chmod 0400 $DIR/*-key.pem chmod 0444 $DIR/ca.pem $DIR/*-cert.pem # Remove Temporary Files rm -f $DIR/*.csr $DIR/*.cnf 修改Docker配置文件 #找到/lib/systemd/system/docker.service中的这一行，改为 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock #后面加上如下参数 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \ --tlscacert=/etc/docker/ca.pem \ --tlscert=/etc/docker/server-cert.pem \ --tlskey=/etc/docker/server-key.pem \ -H tcp://0.0.0.0:2376 重启Doker systemctl daemon-reload && systemctl restart docker 验证 docker --tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/client-cert.pem --tlskey=/etc/docker/client-key.pem -H x.x.x.x:2376 version2023-6-7 0 2073 标签: docker -
CentOS7 安装docker
安装gcc yum -y install gcc yum -y install gcc-c++ 卸载旧版（没有可忽略） yum remove docker \ docker-client \ docker-client-latest \ docker-common \ docker-latest \ docker-latest-logrotate \ docker-logrotate \ docker-selinux \ docker-engine-selinux \ docker-engine \ docker-ce 安装软件包 yum install -y yum-utils 设置镜像仓库 yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo 更新软件包索引 yum makecache fast 安装docker yum -y install docker-ce docker-ce-cli containerd.io 启动docker systemctl start docker 加入开机启动 systemctl enable docker2023-6-7 0 1980 标签: docker
最新评论
Aman 3年前
@阿巴阿巴：define
阿巴阿巴 3年前
如果waf屏蔽了$该怎么绕啊楼主
Aman 3年前
@啊啊：没有，等有空我完善下打包成插件
啊啊 3年前
博主 这个有视频教程吗 没看懂....
Aman 3年前
@波波：密码随意
波波 3年前
这句话的怎么连接啊，楼主
Aman 3年前
Hi